Learn Cloud NetAzure networking, beginner to advanced0 XP0/80
Advanced · DNS · 11 of 32

Resolve private endpoints with a custom DNS server

Your tasks
  • Make stlogs01.blob.core.windows.net resolve to 10.0.3.4 from vm-spoke1
  • Look the name up from vm-spoke1

The company runs its own DNS server, dns-hub at 10.0.4.4, which forwards privatelink names to Azure DNS. The privatelink zone is linked to the hub only. Point vnet-spoke1 at dns-hub and watch stlogs01 start resolving to its private endpoint.

You'll learn
Custom DNS servers

  1. Connect to vm-spoke1.

    ssh vm-spoke1
    What's this?

    Opens a shell on vm-spoke1, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

  2. Look the name up with Azure DNS. The spoke isn't linked, so it's public. Type exit when done.

    nslookup stlogs01.blob.core.windows.net
    What's this?

    Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.

  3. Point the spoke at the company DNS server.

    az network vnet update -g rg-lab --name vnet-spoke1 --dns-servers 10.0.4.4
    What's this?

    Changes a virtual network, such as its address space or the DNS servers its VMs use.

    • -g the resource group the resources live in
    • --name the name of the thing to look at or change
    • --dns-servers 10.0.4.4 custom DNS for every VM in the VNet

  4. Connect again.

    ssh vm-spoke1
    What's this?

    Opens a shell on vm-spoke1, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

  5. Look it up through dns-hub. Type exit when done.

    nslookup stlogs01.blob.core.windows.net
    What's this?

    Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.

  6. Answer the question below.

    Custom DNS server
    A DNS server you run and set on the virtual network, instead of Azure-provided DNS.
    168.63.129.16
    A special Azure virtual IP address, used by Azure-provided DNS and by health probes.
    Zone link
    Connects a private DNS zone to a virtual network, so VMs there can look up its names.
Sources on Microsoft Learn (3)
Name resolution that uses your own DNS serverTroubleshoot private endpoint DNS resolutionPrivate endpoint DNS integration: on-premises workloads
0/1 changes
Network map
?
  • Resource group, the outer dashed frame
  • Virtual network, with its address space top right
  • Subnet, with range and usable IPs (5 reserved)
  • Network security group. A small shield on a VM's NIC means the NIC has one too
  • Route table on the subnet
  • NICVM Appliance Private endpoint
  • Peering Connected Initiated or access off
  • Goal working Goal broken, X marks where it stops
  • Private DNS zone, dotted lines go to linked VNets
  • Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
Resource grouprg-labvnet-spoke1: tap to inspectVirtual networkvnet-spoke110.1.0.0/16subnet-app: tap to inspectsubnet-app10.1.1.0/24 · 251 usablevm-spoke1 10.1.1.4: tap to inspectNICvm-spoke110.1.1.4vnet-hub: tap to inspectVirtual networkvnet-hub10.0.0.0/16subnet-pe: tap to inspectsubnet-pe10.0.3.0/24 · 251 usablepe-stlogs01 10.0.3.4: tap to inspectpe-stlogs0110.0.3.4subnet-dns: tap to inspectsubnet-dns10.0.4.0/24 · 251 usabledns-hub 10.0.4.4: tap to inspectNICdns-hub10.0.4.4Connected: tap to inspectpeeredprivatelink.blob.core.windows.net: tap to inspectDNSPrivate DNS zone · privatelink.blob.core.windows.net · 1 link · stlogs01 → 10.0.3.4stlogs01.blob.core.windows.net?:443 ✗
  • vm-spoke1 → stlogs01.blob.core.windows.net:443should work: not working
Goals 0/3
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$